Hashes & HMAC
100% LocalCompute MD5, SHA-1, SHA-256 and HMAC-SHA256 locally.
MD5
SHA-1
SHA-256
Hashes & HMAC
Compute MD5, SHA-1, SHA-256, and HMAC-SHA256 locally using Web Crypto. Intended for utility checks, not for storing secrets.
Type or paste text to generate hashes. All algorithms run in parallel.
Learn More
AES Interoperability Across 7 Libraries: We Encrypted the Same Plaintext Everywhere and Compared Results
Base64 Encoding: When You Should and Shouldn't Use It (2026 Guide)
Bcrypt vs. Argon2 in Practice: Choosing the Right Hashing Algorithm
Don't settle for MD5 or SHA-256 for passwords. Learn why Bcrypt and Argon2 are the industry standards, how they differ, and which one you should use for your next project in 2026.
What is Hashes & HMAC?
Frequently Asked Questions
Technical Deep Dive
Hashes & HMAC
Generate common hashes for quick checks and compute HMAC-SHA256 with a provided secret key. Uses Web Crypto for modern algorithms and a pure JS MD5 for convenience.
Use SHA-256 or HMAC here for integrity and webhook signatures. Do not hash passwords with SHA-256, use bcrypt or Argon2id.
HMAC-SHA256 hello with key secret should match openssl dgst -sha256 -hmac secret on the same bytes. Hex vs Base64 is the usual mismatch.
MD5 is here for legacy checksums only. It is not collision-resistant. File hashing of multi-megabyte blobs can freeze the tab.
01 Algorithm Vulnerability Matrix
| Algorithm | Digest Size | Security Status | Recommended Use |
|---|---|---|---|
| MD5 | 128-bit | Broken | Non-security checksums |
| SHA-1 | 160-bit | Legacy | Git history compatibility |
| SHA-256 | 256-bit | Secure | General purpose security |
| SHA-512 | 512-bit | Secure | High-margin security |
02 Hash Construction Pipeline
Uint8Array to ensure consistent byte representation across different platform environments.
SubtleCrypto.digest() method processes the buffer through the selected mathematical transformation (e.g., SHA-256).
03 Why HMAC exists: length extension
The obvious way to authenticate a message is SHA256(secret + message). It is broken. MD5, SHA-1, and SHA-256 are Merkle-Damgård constructions: the digest is the internal state after the last block. An attacker who has that digest can resume hashing from it and compute SHA256(secret + message + padding + anything) without ever knowing the secret. That is a length-extension attack, and it has been used to forge signed API requests in the wild.
HMAC fixes it structurally: H((key ⊕ opad) ∥ H((key ⊕ ipad) ∥ message)). The outer hash wraps the inner one, so the value you publish is not a resumable internal state. SHA-512/256 and the SHA-3 family are also immune because of how they are built, but HMAC is the portable answer and the one every webhook provider (Stripe, GitHub, Shopify) uses. If you are verifying a signature header, you are almost certainly re-computing an HMAC and comparing it with a constant-time equality check.
04 Hex vs Base64: the mismatch that wastes an afternoon
A SHA-256 digest is 32 raw bytes. Nothing more. Every "hash" you see is those bytes rendered in some encoding, and providers do not agree on which. sha256sum and OpenSSL print lowercase hex (64 characters). Stripe's webhook signature is hex. GitHub's is hex with a sha256= prefix. AWS Signature V4 is hex. But many JWT and OAuth contexts use base64url, and some legacy systems use uppercase hex or standard base64 with +//=.
When your computed signature "doesn't match", the bytes are usually identical and only the rendering differs. Decode both sides to raw bytes and compare those. This tool shows hex and Base64 side by side for exactly that reason. Also watch the input encoding: hashing the string "48656c6c6f" is not the same as hashing the 5 bytes Hello — decide whether your upstream hashes the UTF-8 text or the decoded binary before you debug anything else.
05 Where SHA-3 and BLAKE3 fit
SHA-256 is not going anywhere — it is fast, hardware-accelerated on every modern CPU, and has no practical weakness. SHA-3 (Keccak) was standardised as a structurally different backup in case a flaw is ever found in SHA-2; it is slower in software and you should only reach for it when a spec demands it. BLAKE3 is the interesting one for tooling: it is a tree hash, so it parallelises across cores and SIMD lanes and out-runs SHA-256 by several times on large inputs, which is why build systems and content-addressed stores are adopting it. For interoperability with the rest of the world, though, SHA-256 remains the default and the safe choice.